Site Mobile Navigation

Zeroing In on Sources H.P. Used

SAN FRANCISCO, Sept. 15 — Prosecutors looking into the internal spying operation at Hewlett-Packard are beginning to link together a chain of investigators from the company down to the detective agencies that may have been involved in obtaining the phone records of its directors and a number of journalists.

According to people briefed on Hewlett-Packard’s review of its internal investigation, prosecutors are focusing on the role of the Action Research Group of Melbourne, Fla. Congressional investigators identified the company this year as one of the most prolific users of subterfuge for obtaining phone records, a method known as pretexting.

Hewlett-Packard has said that it hired investigators who used such a technique in their search to identify a director who the company said was leaking information to the news media. California and federal prosecutors are investigating whether the internal investigation broke any laws, and the California attorney general has said indictments are likely.

An owner of the Action Research Group, Joseph DePante, when asked by telephone on Friday about the Hewlett-Packard investigation, said: “I don’t know anything about that. Thank you for calling.” He refused to comment further.

Mr. DePante, 59, started his business in 1989 and is a licensed private investigator. The firm’s Web site says it has databases of records that help collection agencies, lawyers and other private detectives collect debts. The site also advertises searches for criminal, financial and employment records. The company’s manager, Matthew DePante, 27, is described as “knowledgeable in all areas of telephone research.”

In addition to the Florida firm, prosecutors have been examining the role of Security Outsourcing Solutions, a tiny Boston-area private detective firm. The firm and its principal, Ronald R. DeLia, have ties to Hewlett-Packard through the company’s Global Investigations Unit, which is based in Massachusetts.

Anthony R. Gentilucci, manager of global investigations for H.P., is president of the New England chapter of the High-Tech Crime Investigation Association, an organization of law enforcement officials, private detectives and corporate security officers. Two of the five other elected officers, Glenn Tandy and Kevin Mazza, also work for H.P.’s security arm, and Mr. DeLia has been a member of the association.

John J. McLean, a police detective in Medford, Mass., and the second vice president of the association, said Mr. DeLia attended meetings and had “an impeccable reputation.” He said Mr. DeLia and Mr. Gentilucci knew each other, “but how close they were, I don’t know.”

Mr. DeLia did not respond to e-mail and telephone messages requesting comment, and Mr. Gentilucci’s office referred all inquiries to Hewlett-Packard’s headquarters.

The links between the men were personal. Mr. Gentilucci and Mr. DeLia were fellow groomsmen in a 1997 wedding in Boston, according to a wedding announcement in The Boston Herald. One of the two best men in the wedding was John Kiernan, a partner in the law firm of Bonner Kiernan Trebach & Crociata, which shares a Boston address and phone number with Security Outsourcing Solutions.

The House Committee on Energy and Commerce has sent a letter to Mr. DeLia requesting that he testify at a subcommittee hearing on the Hewlett-Packard matter on Sept. 28 in Washington. The subcommittee is expected to put Mr. Gentilucci on its witness list as well, a committee staff member said. It has already requested the appearance of Patricia C. Dunn, H.P.’s chairwoman; Larry W. Sonsini, Hewlett-Packard’s outside lawyer; and Ann Baskins, the company’s general counsel.

The same panel, the Subcommittee on Oversight and Investigations, held hearings this year on the use of fraud in obtaining phone records. The panel’s subsequent inquiries identified Action Research, the Florida firm, as “the biggest of the big” among companies using pretexts to obtain phone numbers, said Rob Douglas, an information security consultant who worked for the subcommittee. The company, he said, “is in the inner core” of pretexters.

Mr. Douglas said Action Research takes orders for phone records from hundreds, if not thousands, of private detective agencies, though it sometimes also works for lawyers and other clients. He said Action Research could receive as many as hundreds of orders a day for phone records and other confidential consumer data, charging perhaps $75 to $125 per request.

Deciding whether Action Research has any involvement, illegal or otherwise, in the Hewlett-Packard case is complicated by its location, in Florida.

Some of the records were gained by a computer user with an Internet address owned by Cox Communications, the cable company and Internet service provider, which does not provide Internet cable service in the Melbourne area or in Boston.

A search warrant obtained by California authorities said the Internet address used to obtain the phone records of at least one director and one reporter was 68.99.17.80, which a computer expert traced to a personal computer in Omaha or Council Bluffs, Iowa, the city across the Missouri River from Omaha.

Mr. Douglas said a firm like Action Research could have used a subcontractor or an employee based in the Midwest or employed a technique called spoofing to disguise the origin of its own computer address.

A Hewlett-Packard spokesman declined to comment Friday evening on any contractors that might have been involved.

The outcry over the methods used in Hewlett-Packard’s investigation has forced Ms. Dunn, who authorized it, to step down as chairwoman.

Hewlett-Packard has not publicly identified the investigators it used, though California officials said the company had been cooperative.

One question investigators have been asking is who at Hewlett-Packard was involved in hiring and supervising the investigators. That is one reason Ms. Baskins, H.P.’s general counsel, has been called by Congressional investigators.

In a June 19 e-mail message to Mr. Sonsini, the outside lawyer, Thomas J. Perkins, a director who resigned in May in a dispute over the investigation, raised the question of the legality of obtaining private phone records without a subpoena. Mr. Sonsini responded that Ms. Baskins had “looked into the legality of every step of the inquiry and was satisfied that it was conducted properly.”

Ms. Baskins, 51, has spent all but one year of her 26-year legal career at H.P. She was promoted to general counsel by Carleton S. Fiorina, the former chairwoman and chief executive.

Ms. Dunn has said she turned to the company’s security department in April or May 2005 for an initial investigation of the leaks, then asked Ms. Baskins’s help in a further investigation last January.

Mr. Gentilucci, the Boston-based investigator for Hewlett-Packard, said in an online résumé that he conducts investigations for the company to protect its “assets, people, property, information and reputation.” A fraud examiner, he worked for the Digital Equipment Corporation, and then for Compaq Computer after it bought Digital, and for H.P. after its merger with Compaq. He was the national president of the high-technology detectives’ trade group in 2003.